Security Rules Fail For SSO/SAML Users and The Group or Other User Attributes Returned from SSO / SAML Provider Are Not Seen in the User Record

[Damien_V]

When a user authenticates with SAML/JWT/Ticket, security rules based on the attributes from the SSO provider do not work and the attributes are not visible in the QMC under the User record.

Environments:

• Qlik Sense Enterprise, all versions

When a user authenticates with SAML, a list of attributes will be given to Qlik Sense based on what is set up in the virtual proxy.  The attributes depend on the implementation.

However, these User attribute(s) returned from the SSO provider are only kept for the user session and are not stored/persisted in the Qlik Sense Repository Database. Therefore, they do not appear in the QMC like attributes synchronized via a UDC connection (data which is persisted to the database).
 

Resolution:

1. Reference the attributes via user.environment.[attribute name] (not user.[attribute name])
2. View the exact attributes returned from the SSO provider by examining the logs:
   
   
   1. Set the Proxy Audit Logs to the DEBUG level
      
      
   2. After enabling debug logging, the (Trace/Audit) Proxy logs will reveal the extracted attribute(s). No restart is required. 
      
      The default location for this log is in C:\ProgramData\Qlik\Sense\Log\Proxy\Trace\servername_Proxy_audit.txt
      
      Example Headers that will be injected:
      
      [X-Qlik-Security, OS=Windows; Device=Default; Browser=Firefox 50.0; IP=fe80::f0bf:12cb:47cd:2086%14; ClientOsVersion=6.3; SecureRequest=true; Context=AppAccess; role=Domain+Users; role=group5; ] || [X-Qlik-User, UserDirectory=DOMAIN; UserId=user5] || [X-Qlik-ProxySession, b29118dd-4539-4742-ad65-fe307eb10b54] || [X-Qlik-ProxyId, ProxyId=38daa8e0-5330-4581-9f40-49d7418b858f; Prefix=adfs] || [X-Qlik-Trace, cf2e0117-ee82-4d26-bba8-b781fc4ef19e:::]

[jpbartolomeo1]

Thanks for the article!

I'm having some problems, though, while trying to use the new field in a security rule.

I've mapped the SAML field I receive to environment.group and it's detected correctly. If I go to Users and click the information of the user, a lot of environment.group appear for that user with the groups I need. But when I create a security rule trying to use the new user.environment.group, and I put the value as received (as I see it in the user's description), the rule doesn't work. I tried to use an "=" for the condition and tried different cases, also tried to use LIKE and combine the complete name of the group or a partial one with * and the rule doesn't work.

Is there a way to see why the rule doesn't apply? The claim mapping is working correctly.

Regards

[yeheyies]

@Damien_V  @Sonja_Bauernfeind

We are currently in the process of integrating our Qlik system with OKTA SSO and have a couple of questions regarding this integration. Specifically, we would like to verify whether it is possible to populate the "Name" field and if we can also populate custom properties on user accounts through a SAML attribute assertion.

We've encountered this issue while trying to configure SAML attributes mapping in Qlik QMC. We've attempted to set different values for user id, email, names, etc. However, despite these efforts, the update only appears in the proxy logs and is not reflected in QMC. The QMC seems to be populating the name field solely with the value we have for user Id, completely ignoring the configurations we've made in the SAML attributes mapping. Please let us know. Thanks

[Damien_V]

@yeheyies 

It's not possible to populate the name (display name) with a SAML attribute, please see

https://community.qlik.com/t5/Official-Support-Articles/Qlik-Sense-Is-it-possible-to-use-a-SAML-attr...